HighVulnerability

GHSA-4v6f-7vjh-6x4m: Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-115419GHSA-4v6f-7vjh-6x4m
Published: October 23, 2026
Record updated: October 24, 2026

Affected: strands-agents < 1.43.0, fixed in 1.43.0
@strands-agents/sdk < 1.5.0, fixed in 1.5.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.3%

Summary

Strands Agents SDK, shipped as strands-agents for Python and @strands-agents/sdk for TypeScript, shares conversation history across callers with different context_id values in the Agent2Agent (A2A) server under certain circumstances. An authenticated remote user in a multi-tenant deployment can read another caller's conversation history or influence model behavior for that caller (CWE-488). Affected versions are strands-agents below 1.43.0 for Python and @strands-agents/sdk below 1.5.0 for TypeScript.

Mitigation

Upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript), which use an agent factory to isolate conversation state per A2A context_id. Ensure any forked or derivative code incorporates the fixes. Until upgrading, do not expose an A2A server to more than one user or tenant; if multiple callers need access, run a separate A2A server instance for each user or tenant. The source states there is no workaround that fully addresses the issue in affected versions.

Details

Scores and exploitation

CVSS score: 8.1(high)
Patch available: Yes
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector: network
Attack complexity: low
Privileges required: low
User interaction: none
EPSS: 0.3%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 24, 2026.
Disclosure date: October 23, 2026

Weaknesses and techniques

Weakness (CWE): CWE-488

Affected

Packages: strands-agents@< 1.43.0 (fixed: 1.43.0)
@strands-agents/sdk@< 1.5.0 (fixed: 1.5.0)
Vendors: Amazon

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: Agent
Impact: Confidentiality,
Integrity
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-4v6f-7vjh-6x4m

First tracked: October 24, 2026 at 08:09 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

strands-agentsPyPILLM dependency since 2025-05-14 · 9 tracked dependents

Coverage

News, research and other items that mention CVE-2026-115419.

CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerAWS Security Bulletins · 2026-10-22

Topics

Agent-to-agent protocols

Summary

Mitigation

Affected packages in the Exposure Registry

Coverage

Topics

Related items